Malicious Browser Extensions on the Rise

Malicious browser extensions are increasingly abusing trusted distribution channels and broad browser permissions to act as stealthy access brokers for enterprises, enabling large‑scale credential theft, session hijacking, surveillance, and malware delivery directly from within users’ everyday web workflows.

Overview

Malicious browser extensions are an escalating enterprise risk because they run in the browser, where users authenticate, access SaaS applications, handle financial workflows, and move sensitive data. Attackers increasingly use “trusted distribution” by publishing extensions in official stores, compromising legitimate developer accounts, or taking over established extensions, then pushing weaponized updates to users who already trust the add-on. Once installed, an extension can request broad permissions that allow it to read and modify web page content, observe user activity across visited sites, and silently transmit data to an attacker's infrastructure. In practical terms, this enables credential and session-token theft, redirection to phishing pages, manipulation of transactions, and surveillance of corporate browsing, often blending into normal web traffic and evading traditional endpoint controls. Recent real-world campaigns show this is not theoretical: “sleeper” extensions can remain benign for long periods to build reputation and installs, then activate spyware or theft functions through updates, creating immediate scale without new user interaction. Proofs-of-concept and active incidents confirm that a single extension with broad access can turn the browser into an access broker for the enterprise, enabling account takeover and persistent visibility into user activity until the extension removed and affected sessions are invalidated.

Key Findings:

• Malicious browser extensions are now a repeatable, scalable enterprise intrusion vector because they operate within the browser, where SaaS authentication and sensitive workflows occur, and can be delivered through trusted distribution channels.
• The most consistent pattern since late 2024 has been trust hijacking through updates: attackers publish in official stores, compromise developers, or take over established extensions, then push weaponized updates to existing users at scale.
• “Sleeper” extensions materially change the risk model by remaining benign long enough to build credibility, then activating spyware, token theft, or redirection behaviors through updates, creating sudden widespread exposure.
• Extension compromise is not limited to privacy loss; observed campaigns have escalated to enterprise impact, including session hijacking for account takeover and social-engineering chains that lead to the installation of remote-access malware.
• Immediate Actions: Temporarily restrict new extension installs to a minimal approved set while validating current inventory and removing non-essential add-ons. Revoke or remove extensions with broad site access and require that any extension needing access to sensitive business domains have narrowly scoped access and clear justification. For users with high-risk extensions installed or recently updated, revoke active sessions for key SaaS and identity platforms and require re-authentication to reduce token-theft persistence.

---

1.0 Threat Overview

Browser extensions started as lightweight utilities, but they have become deeply embedded in how employees authenticate and work in web applications. That shift changed the threat model: extensions execute in the browser and can be granted broad visibility into web activity, making them an attractive foothold for credential theft, session hijacking, and targeted surveillance. Multiple reporting streams show a clear inflection beginning in late 2024. ENISA documented a “surge” in attacks leveraging malicious browser extensions in late 2024, highlighting a campaign that compromised multiple companies’ Chrome extensions and notably targeted extensions tied to AI and VPN themes. Public reporting from Reuters and The Verge described the same campaign pattern: extension developer targeting, followed by malicious updates published through official distribution channels, aimed at stealing sensitive browser data and authenticated sessions.

From 2025 onward, the dominant trend has been “trusted distribution” at scale: attackers publish directly to official stores, compromise developer accounts through phishing or OAuth abuse, or take over previously benign extensions, then push weaponized updates through normal update mechanisms. Sekoia analyzed the late-December 2024 supply-chain activity against extension developers, reinforcing that the attacker’s advantage is not a browser software flaw—it is the inherited trust of an established extension and its update path. This strategy also supports “sleeper” campaigns in which extensions behave normally for long periods to gain installs and reputation before activating malicious capabilities. Malwarebytes reported a sleeper operation that ran for years before turning rogue, affecting roughly 4.3 million installs across Chrome and Edge once malicious updates were deployed.

1.1 Technique Breakdown

Malicious extension operations typically combine three elements: (1) a credible install path, (2) high-impact permissions, and (3) an update or activation method that sustains access. Even when the initial code is modest, permissions can turn the extension into a browser-resident collection and manipulation layer.

1.2 Affected Systems

---

2.0 Preconditions for Exploitation

Malicious browser extension incidents usually succeed without exploiting a browser software vulnerability. Instead, attackers win by abusing the browser’s trust model: extensions are allowed to run in the same environment where users authenticate and conduct business, and updates are delivered through normal channels. ENISA reported a surge in extension-based attacks in late 2024, including a campaign that compromised multiple companies’ Chrome extensions and focused on AI- and VPN-related themes, highlighting that distribution and trust are now the primary battlegrounds. In practice, exploitation requires only a workable installation or update path, permissions that provide meaningful access to web activity, and enough persistence to exfiltrate data or steer users to follow-on compromise. Large “sleeper” campaigns demonstrate how quickly impact can scale once a trusted extension is flipped maliciously via updates, even after years of benign behavior.

---

3.0 Threat Actor Utilization

Threat actors leveraging malicious browser extensions span opportunistic cybercrime through enterprise-targeted operations. The consistent theme is abuse of trust and reach: attackers publish an extension through a store, compromise a legitimate publisher to ship a malicious update, or run “sleeper” extensions that build reputation before switching behavior. This gives adversaries persistent access inside the browser, where sessions, credentials, and business workflows reside, and it scales faster than most endpoint malware campaigns.

---

4.0 Historical Exploit Timeline

---

5.0 Risk and Impact

Malicious browser extensions create disproportionate enterprise risk because they operate inside the browser, where authentication, SaaS workflows, and sensitive data handling occur, and they are often distributed through trusted channels that users rarely scrutinize after installation. ENISA reported a surge in extension-based attacks in late 2024, showing this technique is now mainstream rather than an edge case. When an extension receives broad privileges, Google Chrome Web Store documentation confirms it can read, request, or modify data across visited websites, exposing sessions, form inputs, and in-browser business activity. The Cyberhaven compromise illustrates the impact: a malicious update exfiltrated cookies and authenticated sessions, enabling downstream account takeover without first bypassing endpoint defenses. Malwarebytes has documented “sleeper” campaigns where extensions behaved benignly for years, then switched via updates across millions of devices, creating simultaneous exposure for many organizations.

---

6.0 Recommendations for Mitigation

• Extension Allowlist Baseline: Enforce managed work profiles and restrict synchronization. Require users to operate in a managed browser context so enterprise policies reliably apply and prevent browser data sync from reintroducing unapproved extensions across devices. Restrict sign-in behavior to approved account types where appropriate to reduce unmanaged profile drift.
• Default-deny extension installation with an explicit allowlist model: Configure browsers to block all extensions by default and permit only those explicitly approved, using the platform’s allowlist/blocklist controls. Where feasible, enable a controlled request workflow that allows business teams to request new extensions while preserving a default-deny posture.
• Standardize a baseline of required extensions via enforced installation: For business-critical extensions, deploy them automatically and prevent removal to keep configurations consistent and reduce shadow extension sprawl. Chrome’s ExtensionSettings supports enforced installation modes that prevent users from disabling or removing specified extensions; Microsoft Edge supports a comparable force-install approach via its ExtensionSettings fields.
• Constrain permission scope and control the update channel to reduce “trusted update” risk: Block high-risk extension permissions at the policy level, and limit extension access to only the required URLs and permissions footprint for business use. Separately, pin or stage extension updates and, where warranted, override update URLs or host-packed extensions internally to prevent rapid, unreviewed behavioral shifts from propagating at scale.

---

7.0 Hunter Insights

Malicious browser extensions have shifted from a niche concern to a durable, high‑leverage access vector, giving threat actors persistent visibility into SaaS sessions, finance workflows, and identity tokens without needing a browser exploit. Campaigns like KongTuke’s CrashFix, ShadyPanda's “sleeper” spyware, and GhostPoster show a clear maturation of tradecraft: adversaries now routinely weaponize trusted distribution channels, delay activation to build reputation and installs, and blend monetization (ad/affiliate fraud) with credential and session theft that can pivot into full endpoint compromise via RAT deployment.

Looking forward, organizations should expect three trends to intensify: first, broader cross‑browser supply‑chain abuse as actors increasingly target extension developers and reuse infrastructure to push malicious updates across Chrome, Edge, and Firefox ecosystems. Second, more “low‑noise” sleeper operations that prioritize long‑term data harvesting and session brokerage over noisy exploitation, enabled by auto‑updates and long‑lived SaaS sessions. Third, tighter integration between malicious extensions and post‑exploitation frameworks, with extensions serving as initial access for tailored social-engineering chains that deliver modular RATs, such as ModeloRAT, to domain‑joined systems. Defenders should plan for browser extension governance and telemetry to become first‑class controls, on par with EDR and identity security, rather than treating add‑ons as a user convenience issue.